Lab Module 02: Footprinting and Reconnaissance

• Google Dorks

• https://www.netcraft.com → resources → research tool → site report → domain
• dnsdumpster.com

• sherlock: búsqueda por nombre en redes sociales

• https://whois.domaintools.com

• nslookup

  • set type=a # respuesta no autoritativa (no responde el servidor del dominio)
    <dominio>
    set type=cname # respuesta autoritativa

  • http://www.kloth.net/services/nslookup.php

• tracert <domain> (windows)
  • -h : número de saltos máximos
• traceroute <domain> (Linux)
• https://www.pingplotter.com/
• https://www.solarwinds.com → traceroute NG

• eMailTrackerPro
• https://mxtoolbox.com/
• https://socialcatfish.com/
• https://www.ip2location.com

• recon-ng

• help
  marketplace install all
  modules search
  workspaces [list]
  workspaces create CEH
  db insert domains
  <domains>
  show domains
  modules load brute
  modules load recon/domains-hosts/brute_hosts
  run
  back
  modules load reverse_resolve
  modules load recon/hosts-hosts/reverse_resolve
  run
  show hosts
  back
  modules load reporting/html
  options set FILENAME /home/attacker/Desktop/results.html
  options set CREATOR [your name]
  options set CUSTOMER Certifiedhacker Networks
  run
  back
  
  # información personal
  workspaces create reconn
  modules load recon/domains-contacts/whois_pocs
  info command
  options set SOURCE facebook.com
  
  # información subdominios
  modules load recon/domains-hosts/hackertarget
  options set SOURCE certifiedhacker.com
  run

Ethical Hacker : shellgpt